Privacy Notice

SyncBook operates this service and is the data controller for the personal data described here. That means we decide what data is collected and why.

• Account data, name, business name, discipline, email address and login credentials. Used to create and secure your account. Legal basis: performance of our contract with you.
• Workspace content, clients, projects, scope items, proposals, addendums, invoices, payment records and any material you upload. Used to provide the service. Legal basis: performance of our contract.
• Client approval records, the name, IP address and browser user agent captured when one of your clients accepts or declines a proposal, so the acceptance is evidenced. Legal basis: legitimate interests in providing a reliable commercial record.
• Technical and usage data, IP address, device and browser information, request logs and error reports. Used for security, fraud and abuse prevention, rate limiting, and improving reliability. Legal basis: legitimate interests.
• Support messages, anything you send us. Used to answer you. Legal basis: legitimate interests.

• Service providers, hosting, database, and error-monitoring providers who process data on our instructions.
• Stripe, our payment provider, for the sale of SyncBook subscriptions, subscription management, payments, tax calculation and invoicing.
• Automated analysis providers, where you use AI-assisted scope review, the material you submit for that review is sent to our model provider to produce the suggestion.
• Professional advisers (legal, accounting) and authorities where required by law.

We do not sell personal data.

Our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

We keep workspace content for as long as your account is active, and for a reasonable period afterwards so you can recover or export it. Financial and commercial records may be retained longer where law requires. After that, data is deleted or anonymised.

Subject to local law you may request access to your data, correction, erasure, restriction, portability, or object to processing based on legitimate interests, and withdraw consent where consent is the basis. Contact us to exercise any of these; we aim to respond within one month. If you are in the UK or EEA you also have the right to complain to your supervisory authority.

We apply appropriate technical and organisational measures, including encryption in transit, row-level access controls so one workspace cannot read another's data, and restricted administrative access.

We use only essential cookies and local storage needed to keep you signed in and remember interface preferences. We do not use advertising cookies. Our payment provider may set cookies necessary to complete a checkout.